Alex Joseph
A serious security flaw has been identified in the Balbooa Gridbox extension for Joomla, allowing unauthorized individuals to reset user passwords. This critical vulnerability, tracked as CVE-2026-65887, could enable attackers to gain control over user accounts, posing a significant risk to the security and integrity of affected Joomla websites. While super admin accounts are explicitly excluded from this specific attack vector, the potential for wider site compromise remains high.
This vulnerability is part of a larger discovery of 23 security issues found in Gridbox, with some actively being exploited. It highlights the urgent need for website administrators to take immediate action.
CVE Details
- Product Name: Balbooa Gridbox for Joomla
- Published: July 29, 2026
- Severity: Critical
- Status: Analyzed
Affected Products
The vulnerability affects Balbooa Gridbox versions prior to 2.20.2. If you are running any version of Gridbox earlier than 2.20.2, your website is exposed to this critical flaw.
Current Status
This vulnerability has been thoroughly analyzed and is unfortunately already being actively exploited in the wild. Security teams have confirmed that attackers are leveraging this and related flaws to gain unauthorized access to Joomla sites. This means that simply knowing about the fix is not enough; prompt action is essential to protect your website.
Severity Level
CVE-2026-65887 is rated as Critical with a CVSS score of 9.8. This high score reflects the ease with which the vulnerability can be exploited and the severe impact it can have. An attacker doesn’t need any special privileges or an existing account to perform a password reset, making it a highly attractive target for malicious actors.
Possible Solutions
Protecting your Joomla website from this critical flaw requires immediate action. Here’s what you should do:
- Update Gridbox Immediately: The primary solution is to update your Balbooa Gridbox extension to version 2.20.2 or higher. The vendor, Balbooa, released version 2.20.2 on July 29, 2026, which addresses this specific vulnerability and many others. It is highly recommended to update to the latest stable version, currently Gridbox 2.20.4.0, which includes further security enhancements.
- Backup Your Site: Before performing any updates, always create a full backup of your website. This ensures you can restore your site if any issues arise during the update process.
- Check for Compromise: Given that this vulnerability is actively exploited, it’s crucial to check your website for any signs of compromise. Look for unfamiliar administrator accounts or users in privileged groups, unexpected PHP files in web-accessible directories, recently modified files that you didn’t change, and unusual login attempts or activity in your server logs. Tools like a “Rogue Admin check” and “Suspect Content tool” can help identify these issues.
- Rotate Credentials: If your site was exposed to vulnerable versions, assume that credentials might have been compromised. Change all user passwords, particularly for administrative accounts, and consider rotating your Joomla secret key.
- Temporary Mitigation (If Unable to Patch): If an immediate update is not feasible, consider temporarily disabling the Gridbox extension if your website’s functionality can tolerate it, until you can apply the patch. This should only be a very short-term measure.
References
- https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
- https://www.balbooa.com/gridbox
